Loading story…
Cyble threat intelligence has identified a new Linux botnet, Luno, designed for cryptocurrency mining, remote command execution, and advanced DDoS attacks. The botnet features process masquerading, self-updating, and robust obfuscation, and is marketed for DDoS services on Telegram. Luno targets resource-limited systems and game servers, employing anti-analysis and self-destruct mechanisms to evade detection.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Cryptocurrency-mining malware continued to expand across enterprise and consumer environments through multiple delivery channels, including social media, malicious advertising, and compromised IoT devices. Trend Micro reported that **Digmine** spread through Facebook Messenger by posing as a video file, then abusing active Chrome-based Facebook sessions to message additional victims and install a modified `XMRig` Monero miner. Separately, a malvertising campaign abused **Google DoubleClick** to serve hidden **Coinhive** and private web miners on legitimate high-traffic sites, driving a sharp rise in detections while consuming as much as 80% of affected systems’ CPU resources. Researchers also observed an updated **Bashlite** variant targeting IoT devices, particularly systems exposing the **WeMo UPnP API**, adding cryptocurrency-mining, backdoor, DDoS, and device-bricking functions to its botnet activity. The broader threat reflects a long-running pattern in which attackers exploit known vulnerabilities, weak configurations, and trusted platforms to hijack computing resources across desktops, servers, Linux hosts, mobile devices, and IoT systems for illicit mining, while also creating opportunities for persistence, further compromise, and operational disruption.
Aug 21, 2026
Researchers reported that the **Lucifer** malware evolved from a Windows-based cryptominer into a cross-platform threat targeting **Windows, Linux, and IoT devices** with a mix of **Monero mining, DDoS, command-and-control, and remote execution** capabilities. Check Point linked Lucifer to the earlier **BlackSquid** and **Rudeminer/Spreadminer** activity through shared code traits and Monero wallet overlaps, indicating the operators had likely been active since 2018 and were continuing to release new variants. The campaign hit more than **25 organizations** across the **United States, Ireland, the Netherlands, Turkey, and India**, including victims in **manufacturing, legal, insurance, and banking**. The malware spread by exploiting known flaws—especially **`CVE-2018-10561`** in **Dasan GPON routers**—along with older Windows exploits and brute-force attacks. Researchers said Linux samples supported mining and full C2 functions, while ARM and MIPS variants were used mainly for DDoS operations, underscoring Lucifer's shift into a broader hybrid malware platform.
Aug 14, 2026
SophosLabs reported a Linux botnet dubbed **Chalubo** that compromises Internet-facing SSH servers through brute-force credential attacks and can also run on IoT hardware across multiple CPU architectures. The malware uses a layered infection chain in which a downloader establishes persistence, disguises its process name, retrieves an encrypted and LZMA-compressed payload, and launches the main bot; later campaigns also used the **Elknot** dropper. Researchers said Chalubo encrypts both its core bot and Lua-based command scripts with the **ChaCha** stream cipher and includes anti-analysis features more commonly associated with Windows malware. The botnet was built to conduct distributed denial-of-service activity, with Lua scripts enabling **DNS**, **UDP**, and **SYN flood** attacks. Sophos observed one command directing infected systems to launch a SYN flood against IP address `59.56.76.41` on port `10100`, while excluding several hardcoded addresses from targeting. Although the malware shares some code with **Xor.DDoS** and **Mirai**, researchers assessed it as a distinct family and urged defenders to harden SSH access, replace default credentials, and monitor suspicious outbound traffic to TCP port `8852`.
Jun 29, 2026